Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

349,518

All time

Critical · Active

12,231

CVSS ≥ 9.0

New · 14 days

3,103

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 2911–2940 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-68898	medium	5.8/10	WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68896	medium	6.5/10	WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68894	high	7.1/10	WordPress ShoutOut plugin <= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68884	high	7.1/10	WordPress WP Simple Redirect plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68883	high	7.1/10	WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68882	high	7.5/10	WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68881	high	8.5/10	WordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68871	high	7.1/10	WordPress Dooodl plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68869	critical	9.8/10	WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68866	high	7.1/10	WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68864	high	7.1/10	WordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68859	high	7.1/10	WordPress Syntax Highlighter Compress plugin <= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68858	high	7.1/10	WordPress wpCAS plugin <= 1.07 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68857	critical	9.3/10	WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68849	high	7.1/10	WordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68839	high	7.1/10	WordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68838	high	7.1/10	WordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68835	high	7.1/10	WordPress Ravpage plugin <= 2.33 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68558	medium	6.5/10	WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68538	high	7.1/10	WordPress Craft \| Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68520	high	7.1/10	WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68518	high	7.1/10	WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68510	high	8.1/10	WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68507	medium	6.5/10	WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68073	medium	6.5/10	WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68072	medium	6.5/10	WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68059	high	7.6/10	WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68058	high	7.6/10	WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68057	high	7.6/10	WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68047	high	8.8/10	WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago